Electronic access control device

ABSTRACT

An electronic access control device is disclosed comprising two microprocessors. The first microprocessor receives a wirelessly transmitted that is compared to a stored access code. If those two codes match, the first microprocessor transmits a special communication code to the second microprocessor. The second microprocessor opens the lock if the transmitted communication code matches a stored communication code.

RELATED APPLICATIONS

This application is a continuation-in-part of co-pending U.S. patent application Ser. No. 10/885,998, filed Jul. 7, 2004, which is a continuation of co-pending U.S. patent application Ser. No. 10/024,945, filed Dec. 19, 2001, which is a continuation of U.S. patent application Ser. No. 08/760,062, filed Dec. 4, 1996, and issued as U.S. Pat. No. 6,359,547, which is a continuation-in-part of U.S. patent application Ser. No. 08/339,555, filed Nov. 15, 1994, and issued as U.S. Pat. No. 5,617,082.

This application is also a continuation-in-part of co-pending U.S. patent application Ser. No. 10/329,626, filed Dec. 26, 2002, which claims the benefit of U.S. Provisional Patent Application Ser. No. 60/344,221, filed Dec. 27, 2001.

FIELD OF THE INVENTION

This invention relates generally to access control devices for vending machines, and more particularly to an electronic access control device for a vending machine, or the like, wherein the device is controlled by one or more microprocessors and can be operated by a wireless electronic key.

BACKGROUND OF THE INVENTION

An electronic access control device, such as an electronic combination lock or an electronic alarm system, allows the user to activate or deactivate the access control without the use of the conventional key and mechanical lock mechanism. With the development of microprocessor integrated circuits, it is becoming common to implement microprocessor-based control circuitry in electronic access control devices. Electronic access control devices are known, for example, from U.S. Pat. No. 5,021,776. In this device, and other common electronic access control devices, a microprocessor is used in combination with a keypad and an electrically programmable read only memory (EPROM). The microprocessor compares the combination entered in the keypad by the operator with the combination stored in the EPROM. If the two combinations match, the microprocessor opens the lock.

There are problems associated with previous electronic access control devices. One area of problems concerns the manufacture of the devices, including the difficulty in programming the non-volatile memory, such as the EPROM, for storing the access code and other useful information for the operation of the device. EPROMs, which usually require parallel programming, interrupt the manufacturing process in that they restrict when the manufacturer can program the device. A manufacturer would prefer to program the access code into the EPROM as the last step in the manufacturing process. However, with parallel EPROMs, burning in the code after the device has manufactured is difficult. After the device is soldered together, the manufacturer must contend with integrated circuit pin clips and must worry about interference with other circuitry on the manufactured device. Further, manufacturing, with known electronic access control devices, requires many pin connections which increase manufacturing cost.

Related to the problems associated with the pin connections of the microprocessor integrated circuit (IC) is the concern of device reliability and ease of use. When the device contains a significant number of pin connections, the reliability of the device decreases. Further, serial access to the EPROM to determine the electronic access code is easier than parallel access in terms of pin connections. When the user forgets or loses the access code in the EPROM, a locksmith could plug into the device and retrieve the access code serially without breaking into the safe. However, with parallel EPROMs, serial access is not available.

One common problem associated with previous electronic locks is their potential vulnerability to tampering. A conventional electronic lock receives an access code via an input device such as a keypad or electronic key reader, verifies the access code, and then energizes a solenoid, relay, motor, or the like to open the lock. This arrangement is vulnerable to tampering because if the control circuit is somehow broken in or removed, one can open the lock by “hot-wiring” the control lines for activating the lock-opening mechanism.

Another technically challenging problem is related to the need to provide electrical energy to power the operation of the electronic access control device. For many applications, it is desirable to use a portable or alternative energy source, such as a battery, to power the access control device. A battery, however, has a rather limited amount of electrical energy stored therein. Thus, in many applications it is important to reduce the power consumption of the control circuit and peripheral devices of the access control device to extend the service life of the batteries.

For instance, it is typical to use a solenoid-operated lock in an electronic lock. The consumed by the solenoid in opening the lock is quite significant. Thus, the battery can be rapidly drained by the repeated operation of the solenoid. As another example, it is common to include a low-battery detection circuit in an electronic lock to provide a warning signal to the user when the battery voltage falls below a predetermined level. The operation of the low-battery detection circuit, however, also consumes electrical energy and contributes to the draining of the battery.

Some electronic locks are provided with electronic keys. When an electronic key is presented to a key reader of an associated electronic lock, it transmits an access code to the electronic lock. By using an electronic key, the user does not have to enter manually the access code by means of a keypad. In certain applications, a remote control unit is used which has a radio transmitter to send the access code to the lock without direct electrical contact with the electronic lock.

Although electronic keys are a convenient feature, they have their associated problems. One problem is related to the unauthorized use of the keys. For example, many hotels provide safes equipped with electronic locks in their hotel rooms. Such safes typically allow the hotel guests to set their own access codes. In cases where the hotel guests forget the access codes they set, the hotel management has to send someone with a master key which has a master access code stored therein to open the safes. There is a danger that such a master key may be used for unauthorized opening of other safes in the hotel.

Another problem associated with the use of an electronic key or a wireless access code transmitter is that the key or the transmitter may be lost easily, or the user may simply forget to bring the key or transmitter. This problem is especially serious if the electronic access control device does not provide other means, such as a keypad, for entering the access code.

Vending machines are widely used in various locations as automated means for selling items such as soft drinks, snacks, etc. Traditional vending machines are equipped with mechanical locks, which can be unlocked with a corresponding mechanical key to open the door of the machine to allow reloading of goods and collection of money.

One significant problem with conventional vending machines is the difficulties in managing the distribution and usage of the keys to ensure the security of the locks on the vending machines. The process of collecting money from the vending machines scattered at different places is a very manpower-intensive operation that requires many employees to go into the field with numerous mechanical keys for operating the locks on the vending machines. It requires a considerable amount of attention and efforts to manage and track the distribution of the keys to the field workers to keep the keys secure.

Moreover, the mechanical keys and lock cores of vending machines are a point of attack for vandals. The keys can be lost or copied easily, and the stolen or copied keys may then be used by an unauthorized person to access the machines, and it is difficult to discover such misuses and security breaches. Also, a skilled vandal can easily pick or drill-out the lock core tumblers and measure the key cuts of the lock core tumblers to re-produce a like key and compromise the security. In the event a security breach is identified, the mechanical lock cores of the affected vending machines typically have to be manually replaced, which is a time-consuming and very costly process. Furthermore, mechanical keys and locks are devices that cannot be partially limited in operation they operate indefinitely if in use. Also, they do not have the ability to record access operation attempts of their operation.

SUMMARY OF THE INVENTION

It is a general object of the present invention to develop an electronic access control device which is easier to manufacture and more reliable to operate, and provides improved security to prevent tampering or unauthorized access.

It is an object of the present invention to provide an electronic access control device with a non-volatile memory for storing an access code that permits the manufacturer of the device to easily insert the access code into the device and then read out the code for verification.

It is an object of the present invention to provide an electronic access control device that provides significantly enhanced security and reduced vulnerability to tampering as compared to previous electronic locks.

It is an object of the present invention to develop an electronic access control device which has fewer total components and pin connections for smaller device area and greater reliability.

It is another object of the present invention to develop an electronic access control device with a solenoid-operated lock which has reduced power consumption by reducing the power used in operating the solenoid.

It is a related object of the present invention to develop an electronic access control device that has an improved low-battery detection circuit which has minimized energy consumption.

It is another more specific object of the present invention to provide an electronic access control system with a master key for a plurality of remote electronic locks that effectively prevents the unauthorized use of the master key.

The present invention accomplishes these and other objects and overcomes the drawbacks of the prior art. First, there is provided an electronic access control device which reduces the number of pin connections required to manufacture, to read, to program, and to operate the device. The device multiplexes the inputs and outputs of the microprocessor IC so that a single pin can function as an input in one mode and an output in another. The microprocessor determines, based on the mode of operation, whether a pin functions as an input or an output.

The electronic access control device of the present invention has a communication port connected to selected pins of the microprocessor IC for accessing the non-volatile memory for storing an access code. Through the communication port, the manufacturer can interact with the microprocessor to store an access code into the non-volatile memory and retrieve the access code for verification. By virtue of the provision of the communication port, the factory-programmed access code can be saved into the non-volatile memory after the control circuitry is completely assembled.

In one embodiment, the electronic access control device has a microprocessor IC with a plurality of pins, a keypad for inputting user-entered access codes and a non-volatile memory, such as an EEPROM, external of the microprocessor for storing an access code. At least one of the IC pins is connected to both the keypad and the non-volatile memory for receiving the user-entered code from the keypad and transferring data between the IC and the memory.

In accordance with the object of the invention to reduce the vulnerability to tampering, the present invention provides an electronic access control device which has two microprocessors. The first microprocessor is preferably disposed close to the user interface such as a keypad or an electronic key reader. The second microprocessor is preferably disposed close to the lock mechanism and substantially shielded from external access. When the first microprocessor receives a user-entered code, it compares the entered code to a stored access code. If those two codes match, the first microprocessor transmits a special communication code to the second microprocessor. The second IC opens the lock if the transmitted communication code matches a stored communication code. Since the second IC is well protected from external access, the risk of tampering by hard-wiring is significantly reduced.

This dual-microprocessor arrangement is advantageously used in a voice activated access control system which has a first microprocessor circuit having speech recognition capability, and a second microprocessor circuit which carries out a commanded operation when receiving a correct communication code from the first microprocessor circuit. The first microprocessor circuit may include a transmitter for wireless transmission of the communication code.

The present invention also provides an effective solution to the problem associated with the intensive need for power of the solenoid. In the present invention, the electronic access control device pulses the power to the solenoid so that the overall power consumption in operating the solenoid is lower. Thus, the battery has a longer life and the lock has an increased number of accesses.

In accordance with a related aspect of the present invention, the electronic access control device employs a low-battery detection circuit that is turned off and therefore consumes no electrical power when the microprocessor is in the sleep mode. The low-battery detection circuit uses a combination of a voltage divider and a transistor to compare the battery voltage and the regulated voltage for determining whether the battery voltage is low, and uses another transistor in series with the voltage divider to selectively turn the current through the voltage divider on and off. When the current through the voltage divider is off, the low-voltage detection circuit does not consume electrical energy.

In the case of an electronic access control system with a master key and a plurality of remote electronic locks, the present invention effectively prevents unauthorized use of the master key. In accordance with the present invention, the master key has a master access code and a number of access stored therein. Each of the remote electronic lock has a key reader to communicating with the master key. When an electronic lock detects in the key a correct master access code and a number of access that is at least one, it opens the associated lock and decrements the number of access in the key by one.

In view of the foregoing, the present invention can provide a vending machine with a field-programmable electronic lock. The electronic lock can learn a key code from a corresponding electronic key. Alternatively, the electronic lock can learn that it should be accessed by an electronic switch controlled by a mechanical lock that can be opened with an associated mechanical key. The electronic lock has a learning process activation device that is accessible only when the door of the vending machine is in the open position. Using the learning process activation device, a service person sets the electronic lock in a learning mode, in which the electronic lock receives a key code transmitted from an electronic key, and stores the key code in a non-volatile memory for future access control of the vending machine. In the case where the lock access is to be controlled by the switch-lock combination, during the learning process the electronic lock controller receives an electronic closure signal from the switch. The lock thus learns that it is to open the door of the vending machine in response of the switch signal in lieu of reception of key codes from electronic keys.

The key-learning process in accordance with the invention allows electronic locks in vending machines to be easily and inexpensively programmed in the field. Thus, the electronic locks do not have to be manufactured with pre-defined permanent key codes and are not tied to any specific electronic keys for field use. There is no need to replace any physical part of the electronic lock in this key-learning process to learn a new key code and/or replacing an old key code. In contrast, mechanical locks conventionally used on vending machines have lock cores that have to be manufactured for specific keys, and once manufactured the lock cores cannot be changed. If the mechanical key is lost, the entire lock cores have to be replaced. More than one electronic key can possess a given keycode. The electronic lock on a vending machine can allow more than one keycode to be learned into the lock and used to access the lock.

The use of the field-programmable electronic locks for vending machines provides an effective way to reduce theft and fraud in terms of unauthorized access to the machines. The electronic keys provide a greater level of key security compared to mechanical keys, as they cannot be copied as easily as conventional mechanical keys. The use of non-contact wireless data communication between the key and the lock prevents breeches of security associated with vandals measuring key cuts, copying keys and picking locks. The use of data encryption in the wireless communications between the key and the lock prevents the key code from being copied by electronic monitoring and eavesdropping. The data transmission between the key and lock may be implemented in the infrared range to provide close-proximity highly directional communication of secure codes to further prevent eavesdropping of the security codes and to prevent accidental unlocking of locks.

The use of programmable electronic locks on vending machines and the associated electronic keys also provides advantages in terms of significant reduction in the costs associated with managing the distribution of the keys for unlocking the machines and the monitoring of the usage of the keys. Key IDs in addition to the key codes used in accessing the lock may be used to distinguish keys having the same key codes. Customized access limitations may be programmed by a supervisor into the electronic keys to restrict when and how they can be used to access the vending machines. Each key may also be programmed with a specific list of lock IDs identifying the electronic locks on vending machines that the key is allowed to unlock.

In accordance with one aspect of the invention, a history of access attempts may be stored in each of the electronic key and the electronic lock for audit purposes. The key may store the access history each time it is used to access an electronic lock on a vending machine. Likewise, each electronic lock on a vending machine may store audit data regarding the access attempts directed to it. The audit data may be transferred from the electronic lock to the electronic key during an unlocking operation, and the audit data of different vending machines collected by an electronic key can be later downloaded to a computer for analysis.

In accordance with another aspect of the invention, the electronic lock may accept more than one type of keys and corresponding key codes. The different key types may be associated with different levels of security of the unlocking operations and the type of data transmitted between the key and lock during the unlocking operations.

In accordance with another aspect of the invention, the electronic lock in a vending machine can work in conjunction with an electronic communication device in the vending machine that is in wireless communication with a home base to accomplish many of the same access control, auditing, and additionally some inventory and money settlement processes.

These and other features and advantages of the invention will be more readily apparent upon reading the following description of the preferred embodiment of the invention and upon reference to the accompanying drawings wherein:

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a perspective view showing an electronic access control device having a keypad;

FIG. 2 is a block diagram of the electronic access control device of FIG. 1;

FIG. 3 is the schematic of the electronic access control device;

FIG. 4 is the flow chart at power-up of the device;

FIG. 5 is the flow chart of the device in normal operation;

FIG. 6 is a block diagram of a remote access control device;

FIG. 7 is a schematic of the input electronics of the remote access control device of FIG. 6;

FIG. 8 is a schematic of another embodiment of the electronic control access device which has a non-volatile memory sharing certain pins of a microprocessor with a keypad;

FIG. 9 is a functional block diagram showing an embodiment of an electronic access control device having two microprocessors communicating with each other to provide enhanced security of the device;

FIGS. 10A and 10B are schematic views together showing an application of the dual-microprocessor configuration of FIG. 9 in an electronic combination lock;

FIG. 11 is a functional block diagram showing an application of the dual-microprocessor configuration of FIG. 9 in an ignition control system for a motorcycle;

FIG. 12 is a functional block diagram showing an application of the dual-microprocessor configuration of FIG. 9 in a voice controlled access control device;

FIG. 13 is a functional block diagram showing another embodiment of the voice controlled access control device;

FIG. 14 is a functional block diagram showing another embodiment of the voice controlled access control device which has a central control station and remote devices;

FIG. 15 is a schematic view showing an electronic access control system which has a master key for opening a plurality of remote electronic locks;

FIG. 16 is a schematic view of an electronic alarm system for a bicycle which has a remote control unit mounted in a riding helmet and an electronic alarm mounted on the bicycle;

FIG. 17 is a schematic view of a vending machine and an electronic key for opening an electronic lock inside the vending machine;

FIG. 18 is a perspective view of an electronic lock assembly mounted on a door of a vending machine;

FIG. 19 is a block diagram showing electronic circuit components of an electronic lock used in a vending machine;

FIG. 20 is a block diagram showing electronic circuit components of an electronic key;

FIGS. 21A and 21B are schematic diagrams showing key codes stored in the memories of an electronic key and an electronic lock, respectively;

FIG. 22 is a schematic diagram showing the transmission of data between an electronic lock on a vending machine and an electronic key during a simplified unlocking process;

FIG. 23 is a schematic diagram showing communications between an electronic lock on a vending machine and an electronic key during an unlocking process that has higher security than the process in FIG. 22;

FIG. 24 is a schematic diagram showing communications between an electronic lock on a vending machine and an electronic key during an unlocking process similar to that FIG. 23 but with a step of checking the lock ID for access control;

FIG. 25 is a schematic diagram showing a computer used to program operational limitations into an electronic key;

FIG. 26 is a schematic diagram showing the downloading of audit data from vending machines to an electronic key; and

FIG. 27 is a schematic diagram showing an example of audit data uploaded from a vending machine to an electronic key.

FIG. 28 is a flowchart showing the key code learning process of an embodiment of the electronic lock;

FIG. 29 is a flowchart showing an operation by an embodiment of the electronic key to back up the time and date for restoring the clock of the key in case of a faulty or removed battery;

FIG. 30 is a flow chart showing an operation by the electronic key to record the number of power-up of the key to prevent tampering by battery removal;

FIG. 31 is a schematic block diagram showing an embodiment of a vending machine that has a communication device that is interfaced to the electronic lock and in wireless communications with a home base for access control and auditing purposes;

FIG. 32 is a schematic diagram showing vending machines accessible by an electronic key that has a narrow wireless signal transmission pattern to avoid accidental opening of the vending machines; and,

FIG. 33 is a functional block diagram showing an embodiment of an electronic access control device having two microprocessors communicating with each other and wherein the device wirelessly communicates with an electronic key.

While the invention is susceptible of various modifications and alternative constructions, certain illustrated embodiments hereof have been shown in the drawings and will be described below. It should be understood, however, that there is no intention to limit the invention to the specific forms disclosed, but, on the contrary, the invention is to cover all modifications, alternative constructions and equivalents falling within the spirit and scope of the invention as defined by the appended claims.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

Referring to the drawings, there is shown in FIG. 1 an illustrative electronic access control device 10 having a keypad 11, light emitting diodes (LEDs) 12 and 13, and a mechanical lever arm 14. In this illustration, the device is used as a lock for an office safe. The device can also be applied to various applications including locks for vending machines or amusement games.

The main components of the electronic access code device are shown in FIG. 2 which include a keypad 11, a microprocessor 14, an access code input and output 15, an acoustic output (a piezo ceramic bender, Model No. KB1-1541) 16, LEDs 12 and 13, a voltage regulator (LM2936Z-5.0) 17, a battery 18, an electromechanical driver output 19, an oscillator 20, and a reset circuit 21. Inputs to the device may take the form of a thumbprint scan, a retinal scan, or a magnetic strip input which may work in conjunction with a keypad or as a sole means of input. Outputs may take the form of an alpha-numeric display which may work in conjunction with an acoustic output or an LED or as a sole means of output.

The manufacturers which provide microprocessors applicable to the device include: Micro-Chip (PIC 16C54, PIC 16C57, PIC 16C71, PIC 16C76); Motorola (MC68HC705J1, MC68HC705K1, MC69HC705P6, MC68HC705P8, MC68HC705P9); National Semiconductor (COP 820C); SGS-Thomson (ST 6210); Texas Instruments (370C311); Zilog (Z84C01).

A more detailed schematic of the device is shown in FIG. 3, highlighting the reduced pin configuration and the serial access to the electrically programmable read only memory (EPROM) 22. Several of the pins on the microprocessor 14 are multiplexed and perform multiple functions, at times used as inputs and at times used as outputs; thereby, the pin configuration is able to use only 9 pins for the keypad input, the acoustic output, and the EPROM 22 reading and writing. For example, the 12 keypad entries are shown in rows and columns. Each keypad entry in a row is connected to the corresponding pin. For example, keypads “3”, “6”, and “9” are connected to pin R1. Each keypad entry in the same column is connected to a corresponding pin as well. For example, keys “3”, “0”, “1”, and “2” are all connected to pin C3.

The multiplexing of the keypad allows for input of twelve different inputs (“0” through “9”, PROG, and CLR) using a four by three configuration, as shown in FIG. 4 and FIG. 5. In particular, there are four rows and three columns in this configuration. In accordance with another embodiment, a keypad with four different inputs allows for as little as a two by two configuration through multiplexing the inputs.

The following example will illustrate the multiplexing with respect to the keypad 11. Normally, in sleep mode, pins R1, R2, R3 and R4 are waiting for an input. When, for example, the keypad “3” is input, pin R1, which keypad “3” is connected to, is triggered signifying to the microprocessor 14 that an interrupt has occurred. The microprocessor 14 then executes an interrupt in the software program and changes one of the four pins (R1, R2, R3 and R4) into an output whereby a logic high is sent to the R1 pin. When a keypad is pressed, it acts as a short circuit; thus, when the microprocessor 14 sends out a logic high, it then senses pins C1, C2 and C3 to determine exactly which keypad in the row has been pressed. In this case, where keypad “3” is input, C3 is high. Pressing keypad “3” acts as a short circuit so that when R1 is sent high, there is a direct electrical connection between pin R1 and C3 via keypad “3”. Thus, the microprocessor 14 can determine that keypad “3” was pressed based on R1 and C3 both being logic high.

Another example of using multiple functions as connected to a single pin is the acoustic output 16. The acoustic output 16 is connected, via a transistor, to pin C2. Pin C2 is also connected to keypads “CLR”, “4”, “5”, and “6”. When the microprocessor 14 sends an audible signal output, pin C2 acts as an output. When the microprocessor is sensing the keypad input, C2 acts as an input.

A further example of multiple functions as connected to a single pin is the EPROM 22 sensing function. The EPROM 22, as shown in FIG. 3, is part of the microprocessor 14. The DATA line (bidirectional in that the line is able to input data to write and output data to read) and CLOCK line of the EPROM 22 are connected to C1 and C2, respectively. Pins C1 and C2 are connected to the keypad as well. When the PROGRAM signal is input, C1 and C2 function. as inputs when writing to the memory location in the EPROM and function as outputs when reading from the memory location in the EPROM 22. Through this arrangement, the manufacturer may serially program the device with the access code. The microprocessor 14 uses registers 56 to transmit the incoming serial data into parallel data for the EPROM 22 to input. Further, the end user may read the EPROM 22 access code serially as well. In reading the EPROM 22, only three pins must be accessed (PROGRAM, DATA, and GROUND). The microprocessor 14 uses registers 56 to transmit the outgoing parallel data from the EPROM 22 to serial form for output.

It will be appreciated that by installing a communication port, namely the access code I/O 15, in the microprocessor-based control circuit, the manufacturer of the device can access the EPROM by interacting with the microprocessor 14 via the communication port. By virtue of this arrangement, the manufacturer can program the access code into the EPROM as the last step in the manufacturing process, i.e., after the control circuit has been fully assembled. Thus, there is no longer the need to use a EPROM that is pre-programmed with access codes, or to attempt to input the access code into the EPROM by means of pin clips or the like during the manufacturing process. This ability to program the EPROM after the completion of the control circuit imparts significant flexibility, efficiency, and reliability to the manufacturing process.

The operation of the electronic access code device is shown in flowchart form in FIG. 4 and FIG. 5. FIG. 4 shows the initialization sequence of the device upon power-up 24. The microprocessor, which contains an EPROM 22 and a random access memory (RAM) 23, checks to see if there is an access code stored 25 in the EPROM 22. The microprocessor 14 performs this operation by checking if a proprietary bit sequence is set, wherein the particular sequence of bits signifies that the EPROM 22 has a stored access code. If the bit sequence is present, the EPROM 22 contains the access code, whereby the microprocessor 14 waits for input from the keypad or waits for an external read signal 26 from the microprocessor 14.

If the bit sequence is not present, the EPROM 22 does not contain the access code in its memory. The microprocessor 14 must then wait for the external program signal 28 which signifies that the access code is being written to the EPROM 22. The external program signal, as shown in FIG. 3, is labeled PROGRAM and is connected to pin 104 and pin IRQ of the microprocessor 14. In this mode, when the PROGRAM signal is toggled, this signifies that the access code is being burned into the EPROM 22. The microprocessor 14 then uses the CLOCK and DATA lines to clock in the data thereby reading the access code. Then, the microprocessor 14 stores the access code into memory 30. The microprocessor 14 subsequently sets the proprietary bit sequence on the EPROM 22 signifying that the EPROM 22 contains the access code. Finally, the microprocessor 14 waits for input from the keypad or waits for an external read signal 26 from the microprocessor 14.

The EPROM 22 can also be used to store features other than the access code. It can be used to determine such things as: (1) the amount of time the solenoid 31 is to be energized upon opening the lock; (2) the number of key presses in the access code; (3) the option of disabling the permanent access code temporarily when a new-access code is stored in RAM 23; (4) the device serial number; and (5) the date and time the device was manufactured or put in service. These features allow the manufacturer to deliver to an original equipment manufacturer (OEM) customer a generic electronic lock assembly. The OEM customer may then characterize all the specific lock features at the OEM customer facility.

As shown in FIG. 5, after the power-up initialization routine, the microprocessor waits for an entry from the keypad 32. Several functions are available based on the keypad entry. If the program key (PROG key) is first pressed, the operator wishes to input an additional access code 33. In this mode, the microprocessor 14 inputs the next five numbers from the keypad 34, 35, 36, 37, and 38. The comparator 57, within the microprocessor 14, compares the two numbers and checks if the input number matches the access code 39 from the EPROM 22 which is stored in RAM 23. If the two numbers match, this signifies that the operator knows the access code in the EPROM 22 and therefore has clearance to input an additional access code 40. Thus, the microprocessor accepts the next five numbers from the keypad as the additional access code 41, 42, 43, 44, and 45, and stores the new access code 46 in RAM 23. The operator may then input either the access code from the EPROM 22 or the additional access code to open the lock. The operator may repeat this procedure and place additional access codes into RAM 23. The additional access codes will be stored in RAM 23 until the power is removed from the microprocessor 14 at which time the RAM 23 memory will be lost.

An alternate mode of using the PROG key is to disable the permanent access code in the EPROM 22 temporarily when a new access code is entered into RAM 23. After the PROG key is hit, the microprocessor 14 inputs the next five numbers 34, 35, 36, 37 and 38. The comparator 57, within the microprocessor 14, compares the input number with the permanent access code 39 from EPROM 22. If the two numbers match, the microprocessor 14 inputs a second access code 41, 42, 43, 44, 45. In this alternative, when the microprocessor 14 stores in RAM 23 the new access code 46, it disables access to the permanent access code in RAM 23. Therefore, until the battery 18 is turned off, the only access code available is the new access code stored in RAM 23.

If an operator enters the PROG key at any time other than at the first keypad entry from sleep mode, the microprocessor will display the error message 47 by sounding the acoustic output 16 through pin C2 and the LED 13.

If a number from the keypad 11 is first entered while in sleep mode 48, the microprocessor 14 waits until another four numbers are entered 49, 50, 51, and 52, from the keypad 11. The microprocessor 14 then compares the number entered from the keypad 11 with the access code 53 stored in RAM 23. If the numbers match, the microprocessor 14 energizes the solenoid 31 at the output 54. The microprocessor 14 can also energize a DC motor, an electromechanical relay, or a solid-state relay. If the numbers do not match, the error message is sent 47 by sounding the acoustic output at pin C2.

If the clear key on the keypad is entered at any time in the operation of the device, the microprocessor 14 waits 5 seconds before going back into sleep mode and waiting for the next keypad entry.

One feature of the device is a lockout of keypad operations. If the microprocessor 14 receives three consecutive operations which generate error messages 47, the microprocessor 14 will disable operation of the device for two minutes. Any attempt to operate the device in the two minute lockout period will generate an error message 47.

An additional feature of the system is a requirement that a digit must be entered within a specified time. Otherwise, the microprocessor 14 will send an error message 47 if there is a five second lapse between keypad entries.

A further feature of the system is the modulated voltage across the solenoid 31. When the correct access code is input 53 from the keypad 11, the microprocessor 14 energizes the solenoid 31. The microprocessor 14 must supply sufficient power to the solenoid to unlock the lock (i.e., the solenoid must push the plunger in against the coil to open the lock). This involves two different operations. First, the solenoid 31 must physically push the plunger against the coil. Second, the solenoid 31 must keep the plunger pushed against the coil for the specified time in which to keep the lock unlocked.

The first operation (pushing the plunger) is very energy intensive. The solenoid 31 must exert kinetic and potential energy to physically move the plunger against the coil. The second operation (maintaining the position of the plunger) is less energy intensive. The solenoid 31 must exert only potential energy in terms of keeping the plunger compressed against the coil. The device, in order to unlock the lock, supplies the entire battery power necessary for the solenoid 31 to pull the plunger in against the coil. The microprocessor 14 accesses the timer 55, within the microprocessor 14, whereby the timer indicates when to reduce the power. Once the plunger is pulled in, the microprocessor 14 modulates the voltage to the solenoid 31. This reduces the current into the solenoid while the solenoid plunger is held in since the entire DC current is not required to keep the plunger in the closed position relative to the coil. This in turn reduces the total amp-hours of current out of the battery during an access cycle, and the total number of accesses to the device increases.

By way of example, the solenoid 31 requires 300 milliamps of current to pull the plunger in. The microprocessor 14 accesses the timer 55, waiting 0.5 seconds to do that operation. The microprocessor 14 then drops the solenoid current to 150 milliamps. This current is sufficient for the solenoid 31 to keep the plunger flush against the coil. The microprocessor 14 accesses the timer 55 again, waiting for the timer 55 to indicate that three seconds have passed, supplying the lower current to allow the user to open the door. In this manner, the microprocessor 14 uses approximately 1/2 as much power in the modulated mode.

FIG. 6 highlights another aspect of the invention, the remote operation of the electronic access code device using a battery. The device can be integrated with other electronic devices forming a system of electronic locks. At the center of the system is a central control station whereby each of the devices may be accessed.

The accessed device is designed for low power consumption so that it may operate on a battery for an extended period of time. The remote access device is normally in a sleep mode. In other words, the device is not in active operation. The remote device can “wake-up” from the low power sleep mode in a variety of ways. One method is for the circuitry in the sleep mode device to sense the incoming signal. When the signal is sent, the remote device resumes normal operation. Another method is for the circuitry in the sleep mode device periodically to resume normal operation and sense if there is an incoming signal. If the incoming signal is sent, the circuitry is able to receive the bitstream data that contains the access code. The circuitry thus remains in a low-power sleep-mode condition for the majority of the time, dissipating low power, while no signal is received. The device may then be powered by a battery.

The remote electronic access code device is divided into two parts: the input electronics 60 and the processing electronics 64. The processing electronics 64 contains a microprocessor, an access code input and output, an acoustic output, light emitting diodes (LED), a voltage regulator, and an electromechanical driver output. Thus, the remote device is similar to the microprocessor in processing the input access code, as shown in FIG. 1, except the access code may be input in several ways. In this embodiment, the data stream is input serially into the microprocessor 14 so that a variety of serial inputs may be connected to the input of the microprocessor 14. For example, the access code may be input using a traditional keypad 11 transmitting data in serial mode. Moreover, the data may be input serially using an electromagnetic signal input from the radio frequency (RF), optical frequency or infrared frequency bands. Thus, the microprocessor 14, in this configuration, may accept the input from any one of this inputs.

The input electronics 60 accepts the code sent from the central control. The method of transmitting the code may take several forms including an electromagnetic signal (such as a RF signal sent by an RF serial bitstream transmitter, or an infrared signal) or a data line (telephone line).

When an RF signal is used, the central station transmits a signal via a transmit antenna 63 (transducer that sends radiated electromagnetic fields into space). The radiated waves containing the RF signal contains the bitstream access code which is sent to the input electronics 60. The input electronics 60 contains the RF wake-up 61 and the RF decode circuitry 62. In one embodiment, the RF wake-up circuit 61 is ordinarily in a low power sleep-mode. However, for a 10 millisecond period every 1 second, the RF wake-up circuit 61 senses for an RF bitstream signal. If an RF bitstream signal exists, it remains awake and receives the entire RF bitstream signal. The RF wake-up circuit 61 then sends a wake-up enable signal to the RF decode circuit 62. The RF decode circuit 62, via the antenna 63, translates it into a series of bits and then sends the digital bitstream signal to the processing electronics 65 to determine if the digital bitstream signal contains the access code.

In another embodiment, the RF wake-up circuit 61 remains in low power sleep mode until it senses the RF signal. The RF signal, in this embodiment, contains a low carrier frequency way and a high frequency RF bitstream superimposed on the low frequency carrier wave. When the RF wake-up circuit 61 senses, via the antenna 66, that there is a signal tuned to the low frequency carrier Wave, the RF wake-up circuit 61 sends a wake-up enable signal to the RF decode circuit 62. The RF decode circuit 62 then accepts the RF bitstream access code signal, and translates it into a series of bits for the microprocessor 14.

FIG. 7 shows the schematic of the input electronics 60 wherein the RF wake-up circuit 61 periodically wakes up from a low power sleep mode and senses if there is an incoming RF signal. The RF wake-up circuit 61 consists of two low-power CMOS inverter gates, INV1 and INV2, a CMOS transistor Q3, resistors, and a capacitor. The two inverters INV1 and INV2 are configured in an oscillator configuration in a ratio of 1 to 100. In other words, the oscillator will switch on for 1/100 of a second. At this time, the CMOS transistor Q3 will turn on and supply the battery power to the RF decode circuitry 62. The RF decode circuitry 62 will only draw battery power for 1/100 of the time, and thus the battery will last 100 times longer than if the battery were permanently connected to the RF decode circuitry 62.

The RF decode circuitry 62 consists of two bipolar junction transistors Q1, Q2, two Operational Amplifiers, OP1 and OP2, and resistors, capacitors, inductors and diodes connected to these components. The RF input signal is referred to as an on-off keying of high frequency bursts for set time frames. In the present invention, the frequency is set at 320 MHz. A burst of frequency is detected by the Q1 and Q2 transistors with their circuits tuned to the correct frequency (320 MHz in this example). The RF decode circuitry 62 then senses the data bitstream sent in the form of digital 1 data signal and digital 0 dead band of no frequency. Thus, a train of on and off frequency pulses would be received by the antenna, conditioned and amplified by Q1 and Q2 of the RF decode circuitry 62, and converted to bitstream 1 and 0 digital signals by the two operational amplifier signal conditioners OP1 and OP2.

Typically, the operator of the control unit 59 which contains the RF transmitter will enable the RF transmitter with a transmit button 58 to send an RF on-off keying pulse for approximately one second. The RF signal being transmitted is a digital bitstream conditioned to an RF on-off keying signal which takes about two milliseconds in which to transmit one complete signal. The control unit 59 then repeats the signal over and over for the duration that the RF transmitter is enabled. In order for the receiver to detect one complete bitstream from the transmitter, the RF signal only needs to be sampled for two milliseconds during which the transmitter is enabled and transmitting. If the RF transmitter is enabled for one second, the transmitted bitstream signal takes 1/500 of a second to be transmitted and is repeated 500 times over the entire one second. The receiver is enabled for 1/100 of a second every second, and will have the opportunity to sample and detect a signal that is 1/500 of a second in duration, transmitted 500 times over one second. After the 1/100 of a second, the oscillator, formed by INV1 and INV2, will switch Q3 off, and the battery power to the RF decode circuitry will be shut off. Only the oscillator circuit (INV1 and INV2) will dissipate battery power at a small rate of less than 100 micro-amps.

If less power dissipation by the RF decode circuitry 62 is required, the decode circuitry power duty cycle can be reduced by increasing the oscillator frequency to more than 100 to 1 and thus decreasing the RF decode circuitry 62 sample rate. In order to ensure the RF decode circuitry 62 will be enabled long enough to detect the entire transmitter digital bitstream, the lock CPU would wait for the beginning of the bitstream signal which is received by the RF decode circuitry 62 when the circuitry was enabled and conditioned through OP 1, and then would send an output enable signal back to Q3 to override the oscillator and keep the RF decode circuitry 62 enabled with battery power until the lock. CPU has received the correct amount of bitstream data from the transmitter through the decode circuitry. Thereafter, the lock CPU would disable the Q3 transistor and the RF decode circuitry and let the oscillator go back to its low rate of sampling.

The processing electronics 64 remains in sleep-mode low current operation until a valid on-off keying frequency signal is received while the RF decode circuitry is enabled and a digital bitstream signal is sent to the lock microprocessor 65. Upon transferring the bitstream signal, the microprocessor 14, within the processing electronics, compares the input code with the access code in the comparator. If correct, the solenoid, DC motor, electromechanical relay, or solid-state relay is activated. After this operation, the microprocessor 14 sends a disable signal to the RF wake-up circuit to assume a low power mode.

FIG. 8 shows the schematic of another embodiment of the electronic access control device which also multiplexes the inputs and outputs of the pins of the microprocessor to reduce the number of pins required. The microprocessor 81 used in this embodiment is preferably the MC68HRC705J1A integrated circuit (IC) manufactured by Motorola. As illustrated in FIG. 8, the input devices include a keypad 11 and an electronic key reader 82.

In this embodiment, instead of using an EPROM internal of the microprocessor as in the case of the embodiment of FIG. 3, an EEPROM 84 external of the microprocessor 81 is used to store the programmed access code as well as other useful information. The EEPROM 84 used in this embodiment is preferably the 93LC46 IC manufactured by Microchip. Alternatively, a FLASH read-write memory, or any other type of suitable memory, may be used. To effectively use the limited number of pins of the microprocessor 81, the pins are multiplexed such that the keypad 11 and the EEPROM 84 share several communication pins. As illustrated in FIG. 8, pins 16 (PA2), 17(PA1), 18 (PA0) of the microprocessor 81 are connected to pins 4, 3, and 2 of the EEPROM 84, respectively. These pins of the microprocessor 81 are also connected to the keypad 11 for receiving access codes entered by means of the keypad. Pin 3 (PB5) of the microprocessor 81 is connected to pin 1 of the EEPROM. In this configuration, pins 1-4 of the EEPROM 84 are used, respectively, for chip select, data in, data out, and clock.

In accordance with an aspect of the present invention, the microprocessor-based control circuit further includes a low-battery detection circuit 68 that does not consume electrical power except when a low-battery detection is in progress. As illustrated in FIG. 8, the access control device is powered by a battery pack 70 which includes one or more batteries. The output of battery pack is connected to a voltage regulator 72 which provides a regulated voltage for operating the control circuit. The low-voltage detection circuit 68 includes a voltage divider 74 which has its input end connected to the output of the battery pack 70 (which in the illustrated case is after an isolating diode 71). The voltage divider 74 is connected in series with a transistor 76 to ground. The base of the transistor 76 is connected (via a resister 77) to pin 6 (PB2) of the microprocessor 81. When Pin 6 of the microprocessor 81 is set high, the transistor 76 is turned on, thereby allowing current to flow through the voltage divider 74. When pin 6 is set low, the transistor 76 is turned off, and the current through the voltage divider is cut off. In that case, the output voltage of the voltage divider 74 will be pulled up to that of the battery voltage minus the voltage drop across the diode 71.

The output end of voltage divider 74 is connected to the base of a second transistor 80. The input end of the transistor 80 is connected to the output of the voltage regulator 72, while the output end of the transistor 80 is connected to pin 15 (PA3) of the microprocessor 81. Normally pin 6 of the microprocessor would stay low, and both the transistor 76 and the transistor 80 would be turned off. When a battery voltage test is performed, pin 6 is switched to the high (“1”) state to turn on the transistor 76, and the state of pin 15 is sensed by the microprocessor 81 to determine the on/off state of the transistor 80. If the battery voltage is sufficiently high, the output of the voltage divider 74 would be high enough to turn the transistor 80 off. On the other hand, if the battery voltage is low, the output of the voltage divider would be low enough to turn the transistor 80 on, and pin 15 would be switched to the high state.

In accordance with an important aspect of the present invention, there is provided an electronic access control device that provides substantially enhanced security and reduced vulnerability to tampering by using two microprocessors. FIG. 9 shows generally the functional block diagram of such a device. As illustrated in FIG. 9, the control device has a first microprocessor 90 and a second microprocessor 92. The first microprocessor 90 is connected to an input device 94 for receiving a user-entered control signal signifying a demand to operate an electronic device 98. The second microprocessor 92 controls a driver circuit 96 for energizing the electrical device 98 to effect a desired operation. The electrical device 98 may be, for example, a solenoid, motor, relay, or the like for opening a lock, or, as will be described in greater detail below, the ignition relay of a motorcycle. The first microprocessor 90 may be positioned close to the input device 94, while the second microprocessor 92 may be located close to the electrical device 98 and is preferably well shielded from external access. The two microprocessors are connected by a two-way communication link 100.

As will be described in greater detail below, the user-entered control signal may be, for example, an access code entered using a keypad or electronic key, the operation of an electronic ignition switch controlled by a mechanical lock, or a voice command entered through a voice sensor such as a microphone. Once a user-entered control signal is received, the first microprocessor 90 determines whether the demand to operate the electrical device 98 should be transmitted to the second microprocessor 92. If the demand is to be transmitted, the first microprocessor 90 sends a special communication code to the second microprocessor 92 via the communication link 100. The second microprocessor 92 compares the transmitted communication code with a preset communication code stored in a non-volatile memory 102. If the transmitted code matches the stored code, the second microprocessor 92 activates the driver circuit 96 to energize the electrical device 98.

It will be appreciated that this dual-microprocessor configuration significantly reduces the vulnerability of the device to tampering. Even if a tamperer may gain access to the first microprocessor, it is intended that the second microprocessor is well shielded and therefore cannot be reached easily. Since the second microprocessor responses only to a correct communication code, the tamperer will not be able to use the trick of “hot-wiring” to activate the driver circuit 96.

Moreover, even if the circuit containing the first microprocessor is somehow replaced by another similar microprocessor circuit for which the correct control signal is already known, that new microprocessor is unlikely to know the communication code specific to the second microprocessor 92. In this way, the two microprocessors function as two individual gate keepers. Even if the first microprocessor could be somehow bypassed, the second microprocessor would not activate the driver circuit without receiving the correct communication code.

The microprocessors can also be programmed to implement the “code-hopping” or “rolling-code” scheme used in some existing electronic access control devices to further improve the security of the device. In such a scheme, the preset code stored in the non-volatile memory 102 is used as a seed, and the communication codes stored in the first and second microprocessors are changed as a function of the number of code transmission according to a predefined algorithm based on the seed code. The changes of the communication codes in the two microprocessors are synchronized so that the they remain in operative relationship.

FIGS. 10A and 10B illustrate an application of the dual-microprocessor configuration in an electronic lock. In this embodiment, the control circuit has two halves connected by a cable. The first half, which is shown in FIG. 10A, contains a first microprocessor 110. The second half, shown in FIG. 10B, contains a second microprocessor 112. Pin 11 (PA7) of the first microprocessor 110 is connected to pin 18 (PA0) of the second microprocessor 112 via the cable 115 and the mating connectors 114 and 116 to establish a two-way serial communication channel between the two microprocessors.

The electronic lock has a keypad 11 and an electronic key reader 82 as input devices which are connected to the first microprocessor 110. The second microprocessor 112 controls a energizing circuit 118 for energizing a solenoid 120 to open the lock. When the first microprocessor 110 receives an access code via either the keypad 11 or the key reader 82, it compares the entered access code with an access code stored in its memory. If the entered code matches the stored access code, the first microprocessor 110 transmits a communication code to the second microprocessor 112 via the communication channel described above. The second microprocessor 112 then compares the received communication code with a preset communication code stored in an EEPROM 122. If the two communication codes match, the second microprocessor 112 activates the energizing circuit 118 to energize the solenoid 120 to open the lock.

The correct access code and communication code are preferably stored in the EEPROM 122. During initial power-up, i.e., when the battery is first attached to the electronic lock, the second microprocessor 112 transmits the access code and the communication code to the first microprocessor 110, which then stores the codes in its memory (which may be volatile) for subsequent operation.

The dual-microprocessor configuration illustrated in FIG. 9 can also be advantageously used in other types of applications. For example, FIG. 11 shows an electronic ignition control system for a motorcycle. In this embodiment, the device contains a first microprocessor 126 and a second microprocessor 128 which are connected by a cable 130. A three-position ignition switch 132 is connected to the first microprocessor 126, which may be located close to the ignition switch. The second microprocessor 128 is connected to an ignition relay 134 and an accessory relay 138, and is preferably disposed close to the ignition mechanism of the motorcycle and well protected from external access.

In this arrangement, the ignition switch 132 serves as the input device, and the position of the ignition switch is used as the user-entered control signal. The first microprocessor 126 monitors the switch position. When the ignition switch 132 is turned to the “accessory” position 135, the first microprocessor 126 transmits a communication code together with a switch-position code corresponding to that switch position to the second microprocessor 128. The second microprocessor 128 compares the transmitted communication code with a preset communication code stored in a non-volatile memory 138 which has been programmed at the factory. If the two codes match, the second microprocessor 128 determines from the switch-position code that the switch is set at the accessory position and closes the accessory relay 136.

Similarly, when the ignition switch 132 is turned to the “ignition” position 133, the first microprocessor 126 transmits a communication code and a switch-position code corresponding to the ignition position to the second microprocessor 128. The second microprocessor 128 compares the transmitted communication code with the preset communication code. If the two codes match, the second microprocessor 128 determines from the switch-position code that the switch is set at the ignition position and accordingly closes the ignition relay 134 and the accessory relay 136 to start the engine.

It will be appreciated that due to this dual-microprocessor arrangement, this ignition control system cannot be “hot-wired” to start the engine of the motorcycle like conventional motorcycle ignition control systems. This system is also not susceptible to tampering by replacing the assembly of the ignition switch 132 and the first microprocessor 126 with another such assembly for which an ignition key has been obtained.

FIGS. 12-14 show another advantageous application of the dual-microprocessor configuration of FIG. 9 which utilizes speech recognition to control the operation of an electronic access control device. As illustrated in FIG. 12, the access control device uses a speech recognition microcomputer integrated circuit (IC) 1200 to process voice commands given by a user. The speech recognition IC 1200 is capable of not only recognizing the commands given but also the voice of the speaker. In other words, the IC is capable of speaker dependent recognition, allowing the user to customize the words to be recognized. Such an IC may be, for example, the RSC-164 microcomputer of Sentry Circuits, Inc.

In the embodiment shown in FIG. 12, the speech recognition IC 1200 has a microphone 1202 connected thereto for receiving voice commands from a user. In this embodiment, the combination of the voice recognition IC 1200 and the microphone 1202 serves generally the function of the input device 94 of FIG. 9. An optional keypad 11 may also be used for entering an access code. After receiving a voice command, the speech recognition IC 1200 analyzes the voice command to recognize the command and the voice pattern of the speaker. If the voice recognition IC 1200 recognizes the voice pattern to be that of an authorized user, it transmits a command code corresponding to the command received to the first microprocessor 190. The first microprocessor 190 transmits an operation code corresponding to the command and a communication code stored in its memory to the second microprocessor 192 via a bidirectional communication link 180. The second microprocessor 192 compares the transmitted communication code with a preset communication code which is stored in a non-volatile memory 194. If the two communication codes match, the second microprocessor 192 activates the driver circuit 196 to energize an electrical device 198 to carry out the operation specified by the operation code.

FIG. 13 shows another embodiment of the voice controlled access control device. In this embodiment, the voice recognition IC 1200, which is a microcomputer in itself, is used to serve the function of the first microprocessor 190 of FIG. 12. Upon receiving a voice command through the microphone 1202, the voice recognition IC 1200 recognizes the command and analyzes the voice pattern of the speaker. If the voice recognition IC 1200 determines that the speaker is an authorized user, it transmits an operation code and a communication code stored in its memory 1201 to the second microprocessor 192. If the transmitted communication code matches a preset communication code, the second microprocessor 192 executes the command by activating the driver circuit 196.

FIG. 14 shows another embodiment of the voice operated access control device which includes a central control station 1220 and one or more remote devices in the arrangement shown generally in FIG. 6. The central control station 1220 may be formed as a hand-held remote control unit which can be conveniently carried and handled by the user. For illustration purposes, two remote devices 1212A, 1212B are shown, each of which has its own unique identification code. The identification codes are stored in the memories 1216A, 1216B of the microprocessors 1228A, 1228B of the respective remote devices. The central control station 1220 has a voice recognition IC 1200 coupled to a microphone 1202 for receiving and recognizing a voice command. If the voice pattern of the speaker matches a voice pattern stored in the voice recognition IC 1200, the voice recognition IC transmits a command code corresponding to the given command to a central microprocessor 1222. The command code may contain a code to indicate which remote device is to be contacted. Alternatively, the determination of which remote device is to be contacted may be made by the central microprocessor according to the command code provided by the voice recognition IC 1200.

The central microprocessor contains a memory 1224 which has the identification codes for the remote devices stored therein. After receiving the command code, the central microprocessor 1222 sends out through the transmitter circuit 1226 a bitstream signal which contains the identification code of the remote device to be addressed and an operation code indicating the operation to be performed. In the preferred embodiment, the bitstream signal is transmitted at a radio frequency (RF). Other suitable transmission bands may also be used.

The remote devices 1212A, 1212B preferably are normally in the sleep mode and can wake up in the ways described in conjunction with FIG. 6. In the illustrated embodiment, each remote device has a wake-up circuit 1230A, 1230B and a radio frequency decode circuit 1232A, 1232B. After receiving the bitstream signal from the central control station 1220, the radio frequency decode circuit of each remote device converts the received RF signal into a computer-compatible binary code which includes the identification code and the operation code. Each remote device then compares the received identification code with its own identification code. If the codes match, the remote device carries out the specified operation.

This voice-activated remote access control system finds many applications in different settings. For example, as illustrated in FIG. 14, the remote access control device 1212A is connected to a file cabinet 1240 and a desk 1242 in an office for locking and unlocking the cabinet drawers and desk drawers. By way of example, when the user gives the voice command “lock desk,” the central control station 1220 receives the command through the microphone 1202. If the speaker's voice is recognized, the central control station 1220 sends out a bitstream signal to cause the remote unit 1212A to operate a lock mechanism 1241 in the desk 1240 to lock the desk drawers. As another example illustrated in FIG. 14, the remote device 1212B is used to control a motor 1243 in a tool chest 1244 to lock and unlock the doors and drawers of the tool chest.

In accordance with the object of the present invention to prevent the unauthorized use of electronic keys, there is provided an electronic access control system which has a plurality of remote electronic locks and a master key that has a number of access programmed therein. As illustrated in FIG. 15, the access control system includes a master control device 140 for programming a master access code and the desired number of access into the master key 142. In the illustrated embodiment, the master control device 140 is a personal computer which has an interface device 144, such as a key reader, for communicating with the master key. The master key 142 contains a non-volatile memory which includes an access code storage 146 for storing the master access code specific to the control system, and a counter 148 for storing the number of access allowed. Also shown in FIG. 15 is an electronic lock 150 which can be opened by the master key. The electronic lock has a control circuit based on a microprocessor 151 and a key reader 152 for communicating with the master key. When the master key 142 is presented to the key reader 152, the microprocessor 151 of the electronic lock reads the access code stored in the master key and compares that code to a preset master access code stored in its memory. If the two codes match, the control circuit reads the number of access stored in the master key. If the number of access is one or greater, the microprocessor 151 energizes the solenoid 154 to open the lock 156. In conjunction with the opening of the lock, the microprocessor 151 of the electronic lock 150 decrements the number of access stored in the counter 148 of the master key by one. Thus, if the number of access in the counter 148 is initially set to one, after the opening of the lock the counter is reduced to zero, and the master key cannot be used to open another lock.

In this way, by limiting the number of times the master key 142 can be used to open locks, the unauthorized use of the master key is effectively prevented. For instance, in the setting of a hotel, it is necessary to have a mater key for opening the electronic locks installed in the safes in the hotel rooms. If a hotel guest forgets the access code for the safe in his room, the master key can be programmed with the number of access set to one, and used to open that safe. Since the number of access will be reduced to zero after the lock is opened, the master key cannot be subsequently used to open the safe in another room. The use of the master key is thus strictly controlled.

In accordance with another aspect of the invention, there is provided an alarm system for a bicycle or a similar manually powered vehicle. As illustrated in FIG. 15, this alarm system includes a remote control 160 mounted in the helmet 162 of the rider of the bicycle 166, and an electronic alarm 164 mounted on the bicycle. The remote control 160 has a transmitter 168 for the wireless transmission of a communication code and other types of control signals to the alarm 164 on the bicycle, which has a receiver 170 for receiving the transmitted signals.

In the preferred embodiment, the remote control 160 has a button 172 which when pushed transmits a control signal including the communication code to the alarm 164 on the bicycle to activate or deactivate the alarm. Alternatively, the helmet may be equipped with a keypad for entering an access code by the user. After receiving the access code, the remote control compares the entered access code with a preset access code and transmits the control signals to the electronic alarm on the bicycle when the two access codes match.

The alarm 164 includes a motion detector 174 for sensing the movement of the bicycle 166. If movement of the bicycle is detected by the motion detector 174 when the alarm has been activated, the electronic alarm 164 emits audio and/or visual warning signals to deter the potential theft. A timer 176 is included in the electronic alarm 164 to stop the warning signals after a predetermined amount of time has elapsed.

This bicycle alarm system which has a remote control 172 mounted in the riding helmet 162 has many advantages. Combining the remote control with the riding helmet provides significant convenience to the rider because there is no need to carry the remote control separately. Moreover, because the remote control is integrated in the helmet of the rider, the rider is less likely to lose or misplace the remote control. Furthermore, because the remote control is required to deactivate the alarm system, combining the remote control with the helmet provides an incentive for the rider to wear the helmet when riding the bicycle. In this way, the bicycle alarm system of the present invention contributes to the safety of the rider and helps the rider to obey the law requiring the bicycle rider to wear a helmet.

In an embodiment, an electronic lock system is provided for use in vending machines that provides significantly improved security and ease of management over conventional vending machines equipped with mechanical locks. The term “vending machine” as used herein means a device that performs a money transaction, which may involve the insertion of cash or commercial paper, or the swiping of a credit and/or debit card, and may (but not required to) dispense an item or items or provide functions in response to the money transaction. In this regard, this term is meant to cover broadly machines commonly used for vending drinks and snacks, ATM stations, change machines, toll machines, coin-operated laundry machines, video arcades, etc. FIG. 17 shows, as an example, a vending machine 220 with an embodiment of an electronic lock mounted therein. The vending machine 220 has a front panel 222 or door that can be opened when the electronic lock is unlocked with a properly programmed electronic key 226. It will be appreciated that the vending machine and the electronic key are not shown to scale in FIG. 17, and the view of the electronic key is significantly enlarged with respect to the vending machine to show its features.

The key 226 and the lock preferably communicate with each other wirelessly, which may be via an infrared or radio frequency (RF) channel. In a preferred embodiment, the wireless communications between the key and the lock is via infrared transmissions. The infrared medium is preferred because it is directional and short range, and the infrared circuitry in the lock is not sensitive to the metal cabinet enclosure of the vending machine. Thus the vending machine will less likely be opened accidentally if the key is accidentally operated of if the key is operated to unlock another vending machine nearby. In addition, the infrared light can travel through the selection buttons on the vending machine. This allows the infrared transceiver of the electronic lock to be positioned behind a selection button 230 of the vending machine, as illustrated in FIG. 17. To that end, the vending machine 220 has an infrared transceiver disposed to receive infrared transmission through its front panel 222, and the electronic key 226 has an infrared transceiver at one end 232. As shown in FIG. 17, in one implementation, the electronic key 226 has a very simple profile, having only a “START” button 236 that can be activated by a user for lock opening and key code learning operations. In a preferred embodiment, the “START” button 236 need not be continuously pressed in order for the key to transmit the encrypted code to the lock. Instead, the user only has to only momentarily press the button 236, and the key will automatically stop transmitting after a few seconds, thus the key will not transmit indefinitely and deplete the battery if the button is stuck down. The electronic key 226 also has a light-emitting diode (LED) 238 exposed through a hole in the housing of the key for indication the operation status of the key.

In accordance with an aspect of the invention, the electronic lock assembly is mounted inside the vending machine 220 to prevent unauthorized access and tampering. It can be physically accessed only when it is properly unlocked and the door 222 or front panel of the vending machine is opened. In one embodiment, as shown in FIG. 18, the electronic lock assembly 248 is mounted on the inside of the door 222, and opening the door of the vending machine exposes the lock assembly housing 240. The electronic lock 248 includes a lock shaft 242 that engages into a corresponding receptacle in the body of the vending machine to prevent the door from being opened when it is in a locked position. The electronic circuit of the lock resides in the housing 240 of the lock assembly. The housing 240 has two holes. Behind one hole 244 is a “LEARN” switch connected to the electronic lock circuit. This switch can be accessed and pressed down with a thin object, such as a screwdriver or a car key. Behind the other hole 246 is a light-emitting diode (LED), which servers as a means for providing an indication of the operational state of the electronic lock during a key code learning operation or a lock opening operation, as will be described in greater detail below.

Turning now to FIG. 19, in one embodiment, the circuit of the electronic lock 248 comprises a microcomputer 250, a non-volatile memory 252, a half-duplex IRDA infrared communication interface 254 for communicating with an electronic key, a power supply voltage regulator 256, a lock motor or solenoid control circuit 258, position feedback switches 260, a learn switch 262 as mentioned above, and the LED 264 for state indication. The non-volatile memory is for storing key codes 268, encryption codes 270, and audit data 272, as will be described in greater detail below.

In an alternative embodiment, the vending machine with the electronic lock is to be accessed using a mechanical key rather than an electronic key. To that end, the electronic lock includes an interface to a combination (the “switch-lock” combination) of an electrical switch 274 and a mechanical lock 276 that has a cam for moving the switch into a closed or open position. The electrical switch 274 is normally in an open state and is closed when the mechanical lock 276 is opened using an associated mechanical key 278. The open/close state of the switch 276 is detected by the microcomputer 250 and is used to determine whether the mechanical lock 276 is opened or closed. The microcomputer 250 is programmed to unlock the door 222 of the vending machine 220 in response to the closing of the switch contact caused by unlocking of the mechanical lock 276 using the mechanical key 278. Thus, the unlocking process does not involve the passing of a key code between the electronic lock and an electronic key. Accordingly, as described in greater detail below, during a learning process, the electronic lock learns that it is to be accessed using a mechanical key instead of an electronic key with a key code.

As shown in FIG. 20, in one embodiment, the electronic key 226 includes a microcomputer 280, a non-volatile memory 282, a half-duplex IRDA infrared communication interface 284 for communicating with the electronic lock of a vending machine or with a computer for programming the key, a power source (e.g., a battery) 286, a real-time clock integrated circuit (IC) 294 for generating data indicating the date and time, and the “START” switch 236 and the LED light 238 as mentioned above. The non-volatile memory 282 is for storing a key code 288, encryption codes 290, and audit data 292 generated by the key and/or downloaded from vending machines operated using the key, as will be described below.

The key codes in the keys and the locks of the vending machines are used to define the security and access control strategy of the electronic lock system. Each electronic key 226 has a key code 288 stored therein, and the same key code is stored in the memory 252 of the electronic lock in each vending machine to be operated with the electronic key. During each access attempt, the key code in the electronic key is transferred from the key to the electronic lock using a secured communication method. The electronic lock can be unlocked if the key code it receives from the electronic key matches the key code stored in the memory of the lock.

In one implementation as shown in FIG. 21A, a key code 268 stored in an electronic key includes seven (7) digits. The first digit of the key code is used to indicate the type of the key. As the value of the key-type digit may go from 0 to 9, there may be up to 10 total key types. As will be described below, in one embodiment of the electronic lock system, there are three different key-types: low-security key, standard key, and auto-tracking key, which correspond to different levels of security in lock-opening operation and audit data collection. The next 6 digits in the key code are the access code (000,000 to 999,999). In addition to the 7 digits representing the key type and access code, a key code stored in the electronic key additionally includes two lower digits, which may be used as the identification (ID) code of that key. In this example, the key ID may vary from 0 to 99. Thus, there may be up to 100 keys that have the same key type and access code but different key ID numbers.

Similarly, as shown in FIG. 21B, a key code 268 stored in the electronic lock has seven (7) digits. The first digit indicates the key type, and the remaining 6 digits are the access code. As mentioned above, there may be up to 10 different key types, and the electronic lock may be programmed to accept a number of key codes of different key types.

In accordance with a feature of the invention, the electronic lock 248 of the vending machine 220 is field-programmable. In other words, the key code or key codes of the electronic lock 248 can be programmed (or “learned”) into the non-volatile memory 252 of the lock after the vending machine has been installed in a given location. In a preferred embodiment, the electronic keys to be used to operate the vending machines are programmed with a permanent key code at the factory and ordered by the users of the electronic locks. In the example given above, the users may order up to 100 keys with the same access code. In contrast, the electronic locks to be used in the vending machines are not programmed with any customer-specific key code. Instead, the electronic locks are programmed with a universal code at the factory. The “universal code” is the code put in the lock by the manufacturer of the lock or the vending machine, and is used by the customers to unpack and open the machines after they receive the machines. Thereafter, the electronic locks are installed in the vending machines, which are then shipped to and set up at their respective operating places. In accordance with the invention, the access control strategy is established by “learning” or transferring the access code of the electronic key to be used to operate the machine into the electronic lock via a secured transfer process.

Referring back to FIGS. 17-19 and 28, in one embodiment, to make the electronic lock 248 learn the access code from an associated electronic key 222 or that it is to be controlled by a switch-lock, the service person has to gain access to the LEARN switch 262 of the lock. In addition, it is preferred that the lock microcomputer senses, using the position switches 260, that the lock is in the unlocked position to allow entering into the “learn” mode (step 460 in FIG. 28). To that end, if the door 222 of the vending machine is originally closed and the lock contains the universal key code programmed at the factory, the service person uses a key containing the universal key code to unlock the vending machine and open the door to gain access to the LEARN button of the lock. As mentioned above, the LEARN switch 262 should be at a secured location such that it can be accessed only when the lock is properly unlocked (as opposed to a forced entry) and when the door is open. An assumption in the access control strategy is that an authorized person is servicing and/or reprogramming the lock if the door is properly unlocked and opened. If the microcomputer 250 detects (step 462) that the LEARN switch 262 is pressed (e.g., held for longer than three seconds), it waits (step 466) for the switch to be held in that position for a pre-selected time period (e.g., 3 seconds) and then enters a LEARN process (step 468). In response to the pressing of the learn button, the LED 264 is turn on (step 470). In alternative embodiments, the LEARN switch 262 can be substituted by another activation means that provides a greater level of security, such as a keypad for entering a service authorization code or an electromechanical switch lock that requires a mechanical or another electronic key.

Once the lock 248 is put in the LEARN mode, the service person operates the electronic key 222 containing the desired key code by pressing the button 236 on the key. This causes the key 222 to transmit the key code stored in its memory to the electronic lock. If the electronic key and the lock employ encryption techniques in their communications, the electronic key 222 first encrypts the key code 288 with the encryption codes 290 in its non-volatile memory and then transmits the encrypted code.

The service person is given a pre-selected timeout period (e.g., 15 seconds) to press the key to transmit the key code. To that end, the lock 248 determines whether it has received the transmitted key code (step 472). If it determines (step 474) that a key code transmission is not received within the timeout period, the learning process is terminated. If a key code has been transmitted within the timeout period, the electronic lock 248 receives the transmitted key code via its receiver port 230. If the transmitted code is encrypted, the electronic lock decrypts the received data with the encryption codes 272 in its memory 252. In a preferred embodiment, the encryption codes in the electronic key and the electronic lock are inserted during manufacturing at the factory, and different encryption codes may be used for different vending machine owners (e.g., different soft drink bottlers) so the keys given to one owner may not be learned into and used to access the vending machines of another owner.

If the encryption codes of the key and the lock do not match, the electronic lock will not be able to successfully decrypt the received key code. In that case, the process will end and the lock will not learn the new key code. If, however, the decryption was successful, the lock stores the key code at a proper location in its non-volatile memory 252 according to its key type (step 476). After verifying that the key code is stored correctly in the proper key type location, the lock 248 provides a signal to the service person by flashing the LED 264 to indicate that the LEARN process is successfully completed (step 478). From this point forward, the electronic lock will use the newly learned key code for access control. In other words, it will compare this key code with the key code transmitted from an electronic key to determine whether the door should be unlocked. If there was a key code of the same key type previously stored in the memory 252 prior to the LEARN operation, that old key code will be erased and can no longer be used to access the vending machine.

As mentioned above, in an alternative embodiment, the vending machine equipped with the electronic lock may be accessed with a mechanical key rather than an electronic key. The electronic lock learns that it is to be controlled by the combination of the electrical switch 274 and the mechanical lock in a learning process similar to the one for learning a key code as described above. Specifically, to enable the lock access via the switch-lock, the service person puts the electronic lock into the learn mode by pressing the LEARN switch 262 as described above. Once the electronic lock 248 is in the learn mode, the service person uses the mechanical key 276 to unlock the mechanical lock 276. When the mechanical lock 276 is moved to its unlocked position, its cam closes the contact of the electrical switch 274. The microcomputer 250 of the electronic lock receives the contact-closure signal (i.e., detecting that the electrical switch is closed) and treats the signal as indication that the vending machine is to be accessed using a mechanical key. In response, the microcomputer set its operation mode such that in the future it will unlock the door of the vending machine in response to detecting the closure of the contact of the electrical switch 274. Thus, from this point forward, the vending machine is accessed using the mechanical key 278, which replaces one or more types of electronic keys.

It will be appreciated that the key learning process described above does not require changing or replacing any physical components of the lock. If the electronic key for operating the lock on the vending machine is stolen or lost, the service person will first use a back-up key that has the key code of the key that is lost, or a key that has a different key code that has been previously learned into the lock, to open the door. The service person then uses the key learning process described above to change the key code in the memory of the lock to a new value. This field-programmability of the electronic lock makes key management significantly easier and cost-effective, and provides a greater level of key security compared to mechanical keys. In contrast, with conventional vending machines using mechanical locks, the mechanical keys may be copied or stolen easily, and the entire lock core of each of the vending machines affected has to be replaced in order to change to a different key.

In the illustrated embodiment, one digit in each key code stored in the lock indicates the type of the key, and there may be up to ten different key types. A lock is able to learn one key code for each allowed key type. A key code of a first type may be that learned from a “primary” electronic key for the vending machine, while a key code of a second type may correspond to a different electronic key, such as a “master” key that can be used as a back-up in case the primary key is lost, stolen, broken, or otherwise unavailable.

In a preferred embodiment, as briefly mentioned above, different types of electronic keys (indicated by the different values of the key type digit) are provided that correspond to different levels of security (and the associated complexity of communication) and audit data collection function. The three types of electronic keys are economy key, standard key, switch-lock, and auto-tracking key. The operation of each of these three types of keys is described below.

Referring to FIG. 22, the economy key employs a simple one-way communication process for interacting with a corresponding electronic lock on a vending machine. Since the communication process is simpler and the one-way communication does not require a receiver in the key, the key can be build at a lower cost. As shown in FIG. 22, the memory 302 of the economy key contains a key code 304, an encryption code 306, and a random number 308. In a preferred embodiment, the key starts with a given value of the random number, and the random number changes every time the key cycles through a key code transmission. When a user activates the key by pressing the button on the key, the key uses the encryption code to encrypt (step 310) the key code 304 together with the random number 308, and transmits the encrypted number 312 to the electronic lock. When the electronic lock receives the transmitted encrypted data, it decrypts (step 316) the data with the encryption code 318 in its memory 252. The lock then retrieves the key code 322 from the decrypted data and compares it with the key code 320 of the same type in its memory. If the two key codes do not match, the process ends. If they match, the electronic lock proceeds to unlock the door of the vending machine.

In comparison with the economy key, the standard key provides a more secure unlocking process that requires 2-way encrypted communications between the key and the electronic lock. The 2-way communications is in the form of a bidirectional challenge-response process. Referring to FIG. 23, the memory 330 of the key contains the key code 332, the encryption code 334, a real-time clock timestamp 336, and a random number 338. Similarly, the memory 252 of the electronic lock of the vending machine contains a learned key code 340, the encryption code 342, and an ID 346 of the electronic lock. When the service person presses the transmission button on the electronic key, the electronic key encrypts (step 350) the key code 332 in its memory together with the time stamp 336 and the random number 338, and transmits the encrypted key code and timestamp to the electronic lock of the vending machine. The electronic lock receives the transmitted data 352 through its infrared communication interface and decrypts (step 356) the received data with the encryption code 342 in its memory. Next, the electronic lock compares (step 362) the decrypted key code 360 with the key code 340 of the same type in its memory. If the two key codes don't match, the process ends, and the door will not be unlocked. In that case, the electronic lock sends a code to the key to indicate that the key has tried an incorrect key code.

If the two key codes match, the process continues and enters a second phase in which the electronic lock transmits data to the electronic key. Specifically, the lock encrypts (step 364) the key code, the lock ID 346, and the random number. It then transmits the encrypted key code, lock ID, and the random number (originally sent by the key) to the electronic key. The electronic key receives the encrypted data 366 and decrypts (step 368) the data to retrieve the key code and the lock ID. If the key determines (step 372) that the key code 370 returned by the lock matches the key code 332 in the memory of the key, it stores data regarding the access event, including the lock ID, in an audit trail data portion of the key's memory for audit purposes.

The key then proceeds to the third phase of the unlocking process, in which the key communicates to the lock to allow access. To that end, the key encrypts (step 376) the received lock ID and transmits the encrypted lock ID and random number to the lock. The lock receives the transmitted data 380 and decrypts (step 382) the data to retrieve the lock ID. If the received lock ID 386 matches the lock ID 346 stored in the memory of the lock, the microcomputer of the lock proceeds to unlock the door of the vending machine.

The unlocking operation described above has several advantages. It allows the transfer of the lock ID and the key codes between the electronic key and the lock on the vending machine without repeating numbers or a distinguishable pattern of numbers in case of eavesdropping of repeated access attempts. It also prevents a transfer of data between the key and the lock with different encryption codes. Further, it provides a consistent and secure means of data transfer between the key and the lock for a condition where many keys with the same key code will be expected to communicate with many locks on different vending machines containing that key code. This bi-directional challenge-response encryption scheme provides no risk of the keys and the locks going out of sequence, which is a common problem with unidirectional rolling-code encryption systems.

The lock ID code is used in the unlocking operation described above for generating audit data for audit trail identification purposes and also for data transfer encryption purposes. In an alternative embodiment, however, it is also be used to provide a method for controlling which vending machines a key is allowed to access. In this method, there may be many keys containing the same key code, and there may be many vending machines that have “learned” the same key code. It is possible, however, to specify which vending machines a given key is allowed to access so that a single key cannot open all the vending machines. Referring to FIG. 24, this is accomplished by loading a list of lock ID codes 392 into the memory 330 of that key prior to operation. During an unlocking operation, the key receives a lock ID 374 from the electronic lock on the vending machine and compares the received lock ID with the list of lock IDs 392 in its memory. Only if it is determined (step 398) that the received lock ID 374 matches one of the lock IDs in the list will the key proceed to send the unlock command signal (e.g., the transmission 380 in the third phase) to the electronic lock. As shown in FIG. 24, the unlocking process is otherwise similar to that shown in FIG. 23. This method of access control provides supervisors of the operation the flexibility of allowing or disallowing a given key to access selected vending machines.

In an alternative embodiment, an electronic key may also be programmed with other types of limits of operation of the key. For instance, the key may be programmed with limit registers that contain values chosen by a supervisor to limit the operation of that particular key. In a preferred embodiment, the limit registers 400 (FIG. 20) are part of the non-volatile memory 252. The operation limits include, for example, time of data, date, number of days, number of accesses, number of accesses per day, etc. When the user of the key presses the button on the key to initiate a key code transmission, the microcomputer of the key first compares the limits set in the registers with a real-time clock in the key and an access counter in the key memory. If any of the limits is exceeded, the key will not transmit the key code to the electronic lock and will terminate the operation.

Referring to FIG. 25, the key operation limits may be set by the supervisor 408 of the employee that uses the electronic key 412 to access vending machines in the field. The limits can be selected by using a personal computer (PC) 410 with the appropriate software program. The limits for each key may be customized depending on, for instance, the work schedule or habits of the employee to whom the key is given. For illustration purposes, FIG. 25 shows an exemplary user interface screen 416 for prompting the user 408 to enter the limits. After the limits are selected on the PC 410, they are loaded from the PC into the operation limit registers in the electronic key 412 in a communication process between a key read/write device 418 and the key. During this communication process, other types of data, such as data for updating the real-time clock in the key, may also be loaded into the key. Also, the communication process may be used to transfer data, such as the audit trail data collected from vending machines by the key during previous field operations, from the electronic key 412 to the PC 410.

In accordance with an aspect and alternative embodiment of the invention, an advantage of electronic keys is that they can be used to record and collect and track the attempted accesses of locks on vending machines in the field. Keys that provide this function are of the “auto-tracking” type mentioned above. Referring to FIG. 26, with an auto-tracking key 412, each access attempt triggers an audit data event in both the electronic key and the electronic lock in the vending machine 220. To that end, a space for audit data is reserved in each of the nonvolatile memories of the key 412 and the lock 248. During an access attempt, the key 412 transfers the key code 420 and a timestamp 422 to the lock. Regardless of whether the access attempt succeeds or fails, the lock stores the key code and timestamp in its audit data memory. In one implementation, the lock will filter the number of accesses from a given key in a given period (e.g., one attempt per key for every 20 minutes) so that it does not create a separate record for each access attempt. It may, however, include data in the record counting the number of access attempts from the key in the time period. This minimizes the chances that when a key is used to make many access attempts in a row it will fill the audit trail memory and erase existing records of previous access attempts. One way to set this time period in the lock is to transfer the value of the period from a key (which is in turn set by a supervisor using a PC) to the lock.

If the access attempt results in a key code mismatch or if the key is disallowed for access because an operation limit in its limit registers is reached, the access process is terminates. In either case, the lock transfers its lock ID 428 to the key 412. The key is expected to store the lock ID and the timestamp in its audit data memory as an invalid access attempt.

If, on the other hand, the access attempt results in a valid match of key code and the key has not exceeded its operation limits, the lock still transfers its lock ID to the key 412. The key 412 then stores the lock ID and timestamp in the audit data memory as a record of a proper access. In addition, as the electronic key is an auto-tracking key, the lock transfers all the audit data 428 entries in its audit data memory to the key. The data in the audit data memory includes the lock ID, a record for each access attempt that includes the entire key code (including the key ID digits) received from the key that made the access attempt, and the timestamp for that access attempt. The auto-tracking key 412 then stores the audit data 428 of the lock in its own nonvolatile memory. In this regard, each key preferably is capable of uploading the audit data memories of 400-500 vending machines. This eliminates the need for a separate process or equipment in the field for performing the same data retrieving function.

When the electronic keys 412 are returned to the home base, the audit data they generated themselves and the audit data they collected from the vending machines 220 can be transferred to a central control computer 410. The audit data can be downloaded to the PC 410 by the supervisor using the key read/write device 418 that is also used for programming the electronic key.

By way of example, FIG. 27 shows exemplary audit data collected by an auto-tracking key from a vending machine. In this example, the key code stored in the lock on the vending machine is “A100”. The vending machine was accessed using the auto-tracking key on Dec. 8, 2001. Since the key contains the correct key code, the access operation is successful. Thereafter, there were two unauthorized access attempts. The first unauthorized access attempt on Dec. 19, 2001 failed, because the key code (“A500”) in the electronic key did not match the key code in the lock. The second unauthorized attempt on December 20 used a stolen key with the right key code and was successful. When the auto-tracking key is used on Dec. 22, 2001 to unlock the vending machine, the audit data 432 stored in the memory of the electronic lock on that vending machine are transferred to the auto-tracking key, which stores the transferred audit data in its own memory. As stored in the key, the audit data 436 identifies the vending machine from which the audit data are uploaded. The audit data 436 stored in the key are later downloading to the home base PC.

Due to the various complexities of this system concerning multiple key users, key codes, and the multiple keys sharing the same key codes, as well as the flexibility provided by the ease of changing access codes of the vending machines in the field, it is often desirable to provide simple diagnostic capabilities to the keys, electronic locks. It may also be desirable to provide special reader tools for use in the field.

In one implementation, the electronic key uses its LED light to provides several diagnostic signals to the user when its START button is pressed and when it is communicating with the electronic lock. If the key correctly communicates with the lock and the key codes match, the LED light is on continuously for about five seconds. If the key correctly communicates with the lock but the key codes do not match, the LED light flashes around five times a second for about five seconds. If the key cannot establish correct communication with the lock, the LED light is set to flash faster, such as 25 times a second, for about five seconds. If the key correctly communicates with the lock and the key codes match, but the operation limits set in the limit registers are exceeded, the LED flashes at a lower frequency, such as three times per second for about 3 seconds. If the START switch of the key is pressed and the key does not communicate with the lock and its operation limits are exceeded, the LED first flash quickly, such as 25 times per second, for up to 5 seconds, and then flash three time per second for up to three seconds.

In a preferred embodiment, a diagnostic tool 440 is used in the field to communicate with electronic locks on vending machines, which provide diagnostic information in the event of problems with the operation of the lock or the door. As shown in FIG. 26, the diagnostic tool 440 includes a display 442 that displays information read from the electronic lock. For instance, the display may show each of the access control key codes stored in the non-volatile memory of the lock, the lock ID of that lock, and any other information pertaining to the state of the electronic lock, such as an indication of whether the lock expects the door to be in a locked or unlocked state based on a position-control feedback measured by the lock circuit.

In a preferred embodiment, security measures are implemented in the electronic key concerning key tampering by replacing the battery in the key. It is possible that the employees or thieves that gain access to the electronic keys will attempt to trick the security of the system by tampering with the key. Since the key contains the clock that provides the time and date of access limiting, it is likely the users will attempt to disable or trick the clock to override the access limits. For example, if the key operation limits are set to only allow accesses between 7 AM and 6 PM, the user may attempt to disconnect the battery of the key in-between lock accesses to stop the clock in the key from counting down the time and disabling the key.

Referring to FIG. 29, to reduce of risk of clock tampering by removing the battery, the key is programmed such that it will reset its clock back to approximately the correct time and date after the battery is reconnected. This feature is provided for both cases of the battery going low naturally or if it is tampered with by the user. To that end, each time the START button 236 of the key is pressed (step 490), the microcomputer 280 of the key reads the time and date from the clock 294 (step 492), and stores the time and date data 498 in the non-volatile memory 282 of the key (step 496). Alternatively, the key may store the time and date periodically, such as every 1-2 minutes. Referring now to FIG. 30, if the key battery is disconnected and later a battery is inserted into the key, the key starts a power-up process (step 500). The microprocessor is programmed to read the back-up time and date 498 stored in the non-volatile memory 282 (step 502) and writes that time and date into the clock 294 (step 506). The clock will then run based on the restored time and date as a substitute until the electronic key is re-docked into the cradle and the home base computer 410 stores a new accurate time and date in the clock of the key. When the restored time and date is in use, the key can still be used to access locks on the vending machines as long as the operation limits of the key are not exceeded.

In addition to the time-restoration feature, the microcomputer 280 in the key employs logic that counts the number of times the battery is removed and will immediately disable the key indefinitely if the battery is disconnected and re-connected more than a pre-selected number of times, such as three times. Specifically, the microprocessor maintains in the non-volatile memory 282 a counter 512 that counts the number of times the key has been powered up since the last docking of the key. This counter 512 is cleared each time the key is docked. Each time a battery is inserted in the key and the microcomputer 280 goes through the power-up process (step 506), the microcomputer 280 reads the counter 502 (step 516). If the microcomputer determines (step 518) that the counter reading has reached the allowed number of power-up, such as 3 times, it disables the key from any access operation. If the allowed number of power-up is not reached, the microcomputer increments the counter (step 520). Thereafter, the key continues with regular key operation, but with each access attempt the key will store a “battery removed” bit with the audit data for that access event in the memories of the lock and the key. This “battery removed” bit indicates that the time and date stamp of the access event is recorded after the key battery was disconnected, and that the accuracy of the time and date is questionable.

Referring to FIG. 31, in accordance with a feature of an alternative embodiment, the vending machine 220 is equipped with an electronic device for communicating with the home base. The communication device 560 preferably communicates wirelessly, such as over a RF channel, to the computer 410 at the home base of the owner of the vending machine. The vending machine also includes a vendor controller electronic circuit 562 for controlling the operation of the lock 248. The vendor controller 562 is connected to the lock 248 and the communication device 560. The electronic lock 248 working together with the vendor controller 562 and the communication electronic device 560 in communication with the home base can accomplish many of the same access control and auditing functions described above and additionally some inventory and money settlement processes. For example, the communication device 560 can receive a command from the home base to disable operation of the lock 560 regardless if an electronic key with the correct key code attempts to access the vending machine. Also for example, the lock 248 can indicate to home base computer 410 through the communication device 560 which keys have attempted to access of the vending machine. This arrangement eliminates the need to use an electronic key to collect, store, and transfer the audit events to the home base via the memory and communication medium of the key.

Moreover, the communication device 560 may be used with the vendor control 562 to keep track of the inventory and the cash transactions of the machine. In many cases, when the service person (route driver) visits the machine, his job is to fill the machine and collect money. During this task, the vendor control 562 is involved in interfacing with the service person to ensure the proper resetting and settlement processes take place, and that the service person closes the door of the vending machine. The vendor controller 562 can inform the home base computer of the open/close state of the vending machine door. In the case the Route Driver does not satisfy the conditions of the vendor controller 562 by way of inventory or monetary or debit card processing, the vendor controller can send a disable signal to the electronic lock 248 so the door of the vending machine cannot be closed and locked. Thus, since the service person cannot leave a vendor unlocked, this process would force him to complete the required resetting and settlement processes so the vendor controller can allow the vendor door to be locked before the service person leaves the vending machine.

Referring now to FIG. 32, in accordance with a feature of a preferred embodiment, the wireless transceiver of the electronic key 226 is designed to have limited transmission range and angle to prevent a vending machine 580 from being accidentally opened due to receiving stray transmission from the key when the key is used to open another vending machine 220 in its vicinity. Specifically, the transmitter 582 of the key 220 has a pre-defined transmission angle 586. Also, due to the limited transmission power of the transmitter 582, the transmission from the key 226 has a limited transmission power range 588, beyond which the signal strength is generally too weak for the transceiver 590 of the electronic lock of the vending machine 220 to reliably detect. In a preferred implementation, the transmission power and the transmission angle 586 of the key 226 is selected such that the width 592 of the transmission pattern at the effective transmission range 588 is about the same or smaller than the width of the vending machine 220. As mentioned above, in a preferred implementation, the transceivers in the keys and the electronic locks on vending machines are infrared transmitters for transmitting and receiving infrared signals.

Referring to FIG. 33, a functional block diagram is provided of an embodiment of an electronic access control device having two microprocessors communicating with each other wherein the access control device wirelessly communicates with an electronic key.

In an embodiment, the electronic access control device 3312 can be completely or at least partially mounted within a vending machine 3314. The electronic access control device 3312 can include, but is not necessarily limited to, an input device 3394, a first processor 3390, a non-volatile memory 3352, a second processor 3392, another non-volatile memory 3402, a driver circuit 3396, and an electrical device 3398.

The electronic key 3326 communicates with the input device 3394 of the access control device 3312. The electronic key 3326 preferably includes a non-volatile memory 3382 containing a key code 3388 and an encryption code 3390.

Preferably, the electronic key 3326 uses a wireless means (i.e., radio-frequency, infrared, or the like) to communicate with the input device 3394. Communication between the electronic key 3326 and the input device 3394 can be unidirectional or bidirectional. It is preferred, however, that the data communicated between the electronic key 3326 and the input device 3394 be encrypted as previously described above.

The input device 3394 can comprise a conventional communication interface that uses radio frequency, infrared, or the like for wirelessly communicating with the electronic key. In an embodiment, the input device is a half-duplex IRDA infrared communication interface 254 for communicating with the electronic key. Accordingly, the input device 3394 is mounted on or in the vending machine 3314 so it can receive infrared transmissions.

The input device 3394 provides control signals to the first processor 3390. Although shown in simplified form, the first processor 3390 can include, but is not necessarily limited to, a power supply voltage regulator, a learn switch, an LED for state indication, and a non-volatile memory 3352 for storing key codes 3368, encryption codes 3370, and audit data as previously described above. As will be appreciated by those having ordinary skill in the art, the non-volatile memory 3352 can be integral to, or separate from, the first processor 3390.

The first processor 3390 communicates with the second processor 3392 via a communication link 3400 that can be a conventional data communication bus, wiring, or the like. Further, the second processor 3392 can be a conventional microprocessor device or the like.

In an embodiment, the second processor 3392 is provided with access to a non-volatile memory 3402 and a driver circuit 3396. The non-volatile memory 3402 is conventional and thus can be a CMOS RAM, EEPROM, FLASH, or ROM, that is integral to the second processor 3392 or a standalone device or circuit. The non-volatile memory 3402 preferably stores a preset communication code.

The driver circuit 3396 can include a conventional lock motor driver, solenoid control circuit or the like for operating electrical device 3398 to effect a desired operation. Accordingly, the electrical device 3398 can be, for example, a solenoid, motor, relay, or the like for opening a lock such as a lock on the door of a vending machine.

In an embodiment, but not necessarily, the first processor 3390 can be positioned closed to the input device 3394, while the second processor 3392 can be located close to the electrical device 3396 and well shielded from external access.

In the Learn mode of operation, similar to that previously described above, the electronic key 3326 communicates with the input device 3394 of the access control device 3312. As indicated previously, proper communication between the electronic key 3326 and the access control device 3312 must be established. This can be done by first placing the access control device 3312 in LEARN mode via a switch (262 of FIG. 19). Once the access control device 3312 is put in the LEARN mode, the service person can operate the electronic key 3326 containing preferably at least one desired key code by pressing the button (236 of FIG. 20) on the electronic key. This causes the key 3326 to transmit the key code(s) 3388 stored in its memory to the access control device 3312. If, as preferred, the electronic key 3326 and the access device 3312 employ encryption techniques in their communications, then the electronic key 3326 first encrypts the key code(s) 3388 with the encryption codes 3390 in its non-volatile memory 3382 and then wirelessly transmits the encrypted key code(s).

The input device 3394 receives the wirelessly transmitted encrypted code(s) and provides the data to the first processor 3390. The data is decrypted by the first processor 3390 using the encryption codes 3370 in its associated memory 3352 to obtain the transmitted key code(s) 3388. In a preferred embodiment, the encryption codes 3390 and 3370 in the electronic key 3326 and the access device 3312, respectively, are inserted during manufacturing at the factory and different encryption codes can be used for different vending machine owners (e.g., different soft drink bottlers) so the electronic keys given to one owner may not be learned into and used to access the vending machines of another owner.

As previously indicated above, if the encryption codes of the electronic key and the access control device 3312 do not match, then the access control device will not be able to successfully decrypt the received key code(s). In that case, the process will end and the lock will not learn the new key code(s). If, however, the decryption is successful, then the access control device 3312 will store the key code(s) at a proper location. In an embodiment, at least one key code 3368 can be stored in the non-volatile memory 3352 associated, or part of, the first microprocessor 3390. Further, if desired, another key code can be stored in the non-volatile memory of the second microprocessor 3392.

With the key code(s) stored in the access control device 3312, the device uses the key code(s) for access control. In other words, the access control device 3312 compares the stored key code(s) 3368 with the key code(s) transmitted from the electronic key 3326 to determine whether the vending machine door should be unlocked.

In particular, when a wireless signal is received by the input device 3394, the wireless signal is provided as input data to the first microprocessor 3390 for decryption. The first microprocessor decrypts the input data to obtain at least one transmitted key code that is compared to a key code 3368 stored by a non-volatile memory 3352 associated with the first microprocessor 3390. If the transmitted key code 3388 matches the stored key code 3368, then the first processor 3390 sends a special communication code to the second microprocessor 3392 via communication link 3400. The communication code can, but not necessarily, be encrypted when it is transmitted over the communication link 3400. The communication code can comprise another (i.e., second) key code that is stored in the non-volatile memory 3352 associated with the first microprocessor 3390, or the other (i.e., second) key code can be obtained from the data wirelessly transmitted by the electronic key 3326, or it may have originated from the memory 3402 associated with, or contained within, the second microprocessor 3392.

In the case where the communication code originates in the memory 3402 associated with, or contained within, the second microprocessor 3392, the communication code can be transferred from the second microprocessor memory to the first microprocessor memory (i.e., the memory that is associated or part of the first microprocessor 3390) during an initialization sequence such as during initial power-up. For instance, when power is first applied to the electronic lock, the second microprocessor can transmit the access code and the communication code to the first microprocessor, which then stores the code in memory for subsequent operation. Moreover, encryption and decryption operations between the key 3326 and the lock 3314 can be implemented as described in detail herein.

The second microprocessor 3392 compares the communication code with a communication code stored in the non-volatile memory 3402 associated with the microprocessor. If the communication codes match, then the second microprocessor 3392 activates the driver circuit 3396 to energize the electrical device 3398.

As indicated previously, the electronic access control device 3312 can store in a memory a plurality of access attempt records or an audit trail of the lock access attempt history which can be downloaded externally from the lock to an electronic key or another data storage device. Also as indicated previously, the electronic key 3326 can be controlled by operation limit parameters that will control the operation of the key by a clock and limit parameters. Also as indicated previously, the electronic access control device can communicate diagnostic messages and/or codes to an electronic key or a reading and display device. Also as indicated previously, the electronic access control device 3312 can communicate with a home base, the electronic key, or other device for providing access control and auditing functions. In such an embodiment, the vending machine 3314 can include a vendor controller electronic circuit (562 of FIG. 31) for controlling the operation of the electronic access control device 3312. In such an embodiment, the vendor controller can receive a command from the home base (410 of FIG. 31) to disable operation of the electronic access control device 3312 regardless if an electronic key with the correct key code(s) attempts to access the vending machine. Also, for example, the electronic access control device 3312 can indicate to the home base computer which electronic keys have attempted to access the vending machine. Moreover, the electronic access control device 3312 can transmit its key codes, as encrypted data, when commanded to do so.

In view of the many possible embodiments to which the principles of this invention may be applied, it should be recognized that the embodiments described herein with respect to the drawing figures are meant to be illustrative only and should not be taken as limiting the scope of the invention. Therefore, the invention as described herein contemplates all such embodiments as may come within the scope of the following claims and equivalents thereof. 

1. A method directed to an access control device for a vending machine cabinet, the access control device having a processor and a non-volatile memory for storing an access code, the method comprising the steps of: connecting to a communication port for accessing the non-volatile memory; sending a read signal through the communication port to trigger the control device to transmit the access code stored in the non-volatile memory; encrypting the access code; receiving a transmission of the encrypted access code through the communication port in response to the read signal; and, providing the access control device for accessing the vending machine cabinet by unlocking an outer door to the cabinet via a wireless signal.
 2. The method of claim 1 further comprising the step of providing power to the access control device from a power supply mounted within the vending machine cabinet.
 3. The method of claim 1 wherein the access code is substantially permanently stored in the non-volatile memory.
 4. The method of claim 1 further comprising the step of wirelessly transmitting the encrypted access code.
 5. The method of claim 4 further comprising the steps of decrypting the encrypted access code external to the access control device.
 6. The method of claim 1 further comprising the step of wirelessly transmitting the access code from the access control device.
 7. The method of claim 6 further comprising the step of encrypting the access code before transmitting the access code from the access control device.
 8. The method of claim 1 further comprising the step of providing a data transmission path from the processor to another processor.
 9. The method of claim 1 further comprising the step of providing a data transmission path from the processor to another processor operatively connected to a driver circuit.
 10. The method of claim 1 further comprising the step of providing a data transmission path from the processor to another processor operatively connected to a driver circuit for operating a lock to the vending machine cabinet.
 11. The method of claim 1 further comprising the step of transmitting a serial number from the access control device.
 12. A method directed to an electronic access control device for mounting to a vending machine cabinet, the access control device having a processor-based control circuit including a processor and a non-volatile memory for storing an access code for controlling operation of the access control device, the method comprising: installing the non-volatile memory in the processor-based control circuit; sending a write signal through the communication port to the processor-based control circuit to indicate an access code is to be written into the non-volatile memory; sending an encrypted access code to the access control device; and writing an access code to the non-volatile memory through the communication port for unlocking an outer door of the vending machine cabinet via a wireless signal.
 13. The method of claim 12 further comprising the step of providing power to the access control device from a power supply mounted within the vending machine cabinet.
 14. The method of claim 12 further comprising the step of substantially permanently storing the access code in the non-volatile memory.
 15. The method of claim 12 further comprising the step of wirelessly transmitting the encrypted access code.
 16. The method of claim 12 further comprising the step of decrypting the encrypted access code.
 17. The method of claim 12 further comprising the step of providing a data transmission path from the processor to another processor.
 18. The method of claim 12 further comprising the step of providing a data transmission path from the processor to another processor operatively connected to a driver circuit.
 19. The method of claim 12 further comprising the step of providing a data transmission path from the processor to another processor operatively connected to a driver circuit for operating a lock to the vending machine cabinet.
 20. The method of claim 12 further comprising the step of transmitting a serial number for the access control device.
 21. The method of claim 12 further comprising the step of transmitting an encryption code for the access control device.
 22. An electronic access control device for a vending machine cabinet comprising: a processor-based control circuit comprising a processor and a non-volatile memory; a communication port connected to the processor-based control circuit; and, the processor programmed to: receive a write signal through the communication port; receive an encrypted access code through the communication port in response to the write signal; and, write the received access code into the non-volatile memory for unlocking an outer door of the vending machine cabinet via a wireless signal.
 23. The electronic access control device of claim 22, wherein the control circuit receives power from a power supply mounted within the vending machine cabinet.
 24. The electronic access control device of claim 22, wherein the processor is further programmed to decrypt the encrypted access code.
 25. The electronic access control device of claim 22, wherein the processor is further programmed to receive a serial number for said electronic access control device and write the serial number into the non-volatile memory.
 26. The electronic access control device of claim 22, further comprising a data transmission path from the processor to another processor operatively connected to a driver circuit.
 27. The electronic access control device of claim 22, further comprising a data transmission path from the processor to another processor operatively connected to a driver circuit for operating a lock to the vending machine.
 28. The electronic access control device of claim 22, wherein the access code is an encryption code.
 29. The electronic access control device of claim 22, wherein the write signal is a switch actuator.
 30. The electronic access control device of claim 22, wherein the access control device is unlocked.
 31. The electronic access control device of claim 22, further comprising a data transmission path from the processor to a circuit operatively connected to a driver circuit for operating a lock to the vending machine.
 32. An electronic access control device for a vending machine cabinet comprising: a processor-based control circuit comprising a processor and a non-volatile memory containing an access code for unlocking an outer door to the vending machine cabinet; and a communication port connected to the processor-based control circuit, the processor programmed to receive a read signal through the communication port, and in response to the read signal transmit the access code in the non-volatile memory out through the communication port, wherein said access code is encrypted.
 33. The electronic access control device of claim 32, wherein the control circuit receives power from a power supply mounted within the vending machine cabinet.
 34. The electronic access control device of claim 32, wherein the access code is decrypted after leaving the electronic access control device.
 35. The electronic access control device of claim 34, wherein the access code is a permanent access code.
 36. The electronic access control device of claim 34, further comprising a data transmission path from the processor to a circuit operatively connected to a driver circuit.
 37. An electronic access control device for a vending machine cabinet comprising: first and second controllers separated from each other and shielded from external access, the second controller comprising a memory for storing a communication code; the first controller receiving an encrypted access signal from a key or keypad, and comparing an input access code within the encrypted access signal to a stored access code to determine if the input access code is valid; the first controller sending the communication code to the second controller if the input access code is valid, wherein the second controller provides a signal to energize a circuit to unlock an outer door to the vending machine cabinet; and, wherein the encrypted access signal is transmitted via a wireless signal from outside the vending machine and conveyed to inside the vending machine.
 38. The electronic access control device of claim 37 wherein the second controller receives power from a power supply mounted within the vending machine cabinet.
 39. The electronic access control device of claim 37 wherein the encrypted access signal is transmitted wirelessly from the key.
 40. The electronic access control device of claim 39, the encrypted access signal comprising a key identification code.
 41. The electronic access control device of claim 37 wherein the encrypted access signal is transmitted via infrared from the key.
 42. The electronic access control device of claim 37 wherein the encrypted access signal is transmitted via radio-frequency from the key.
 43. The electronic access control device of claim 37 wherein the encrypted access signal is transmitted directionally from the key.
 44. The electronic access control device of claim 37 wherein first controller decrypts the encrypted access signal to obtain the input access code.
 45. The electronic access control device of claim 37 wherein the input access code is different from the communication code.
 46. The electronic access control device of claim 37 wherein the stored access code is different from the communication code.
 47. The electronic access control device of claim 37 wherein the first controller is operatively coupled to a transceiver that transmits and receives wireless signals.
 48. The electronic access control device of claim 37 wherein the first controller is operatively coupled to a transceiver that transmits and receives infrared signals.
 49. The electronic access control device of claim 48 wherein the transceiver is disposed behind an infrared transparent panel on the vending machine cabinet.
 50. The electronic access control device of claim 37 wherein the stored access code is stored within a non-volatile memory that has multiple key codes stored therein.
 51. The electronic access control device of claim 37 wherein access event data is transmitted regarding access attempts directed to the electronic access control device if the input access code matches the stored access code.
 52. The electronic access control device of claim 37 further comprising a communication device, located at a remote location, that transmits control commands for execution by the first controller or second controller.
 53. The electronic access control device of claim 52 wherein the first controller forwards data to a control computer via the communication device.
 54. The electronic access control device of claim 52, the data forwarded comprising access event data regarding attempts directed to unlocking the vending machine cabinet.
 55. The electronic access control device of claim 37, further comprising a state indication device operable by the first controller or the second controller to indicate operation status of the electronic access control device.
 56. The electronic access control device of claim 37, wherein the second controller receives a request and, in response thereto, transmits the communication code to the first controller.
 57. The electronic access control device of claim 37, the key comprising a non-volatile memory comprising at least one operational limit register for storing an operation limit of the key.
 58. The electronic access control device of claim 37, wherein the first controller transmits an encrypted signal to the key or keypad.
 59. The electronic access control device of claim 58, the encrypted signal comprising a lock identification code.
 60. The electronic access control device of claim 37, wherein the first controller receives a second encrypted access signal from the key or the keypad.
 61. The electronic access control device of claim 37, wherein the stored access code is transmitted wirelessly from the key.
 62. The electronic access control device of claim 37, wherein the stored access code is received and stored in a non-volatile memory during a learn mode of operation.
 63. The electronic access control device of claim 62, wherein the outer door is unlocked before entering into the learn mode.
 64. The electronic access control device of claim 62, wherein the learn mode is initiated by a manual input operation.
 65. The electronic access control device of claim 62, wherein the stored access code is encrypted when transmitted to the electronic access control device.
 66. The electronic access control device of claim 65, wherein the stored access code is decrypted before the stored access code is loaded into memory.
 67. The electronic access control device of claim 63, wherein a verification signal is transmitted after receiving the stored access code. 